Know your updates – Configuring Windows Update for Business Reports
Hello there! It’s been a little while since my last blog post, unfortunately, I was caring for a sick family member but on the positive side, I’m now a father so life has gotten in the way of posting, but I’m back and happy to be blogging again!
More than ever, it’s important to know your update levels for your endpoints, today, I will show you how to configure Windows Update for Business Reports, an analytical service powered by Azure Log Analytics, which will give you key information such as monitoring security, quality and feature updates for Windows 10 and 11, determine which endpoints have issues with updates and produce kusto reports as needed by your organisation, let’s get started!
Prerequisites
You will need the following for a successful setup and enrolment into Windows Update for Business Reports.
- Azure Subscription with at least contributor rights.
- Microsoft Entra ID.
- Endpoints that are Entra \ Entra Hybrid joined (Entra Registered devices are NOT supported).
- Windows 10 / 11 Professional + (WUFB Reports is not supported for Windows Server).
- Windows servicing channel of General Availability Channel.
- Following network endpoints to be allowed via enterprise firewall \ web filtering \ SSL inspection services.
Configure Windows Update for Business Reports Solution
This is a three-part process, one to create an Azure Log Analytics workspace, then configure Windows Update for Business Reports solution integration into that workspace and then finally configure Windows Update for Business Reports from within M365 Admin center, which is a new experience, previously the latter was configured directly within Microsoft Intune.
Creating the Log Analytics Workspace
Log into the Azure portal, go to Create a resource and then search for Log Analytics, then Create:
On the Log Analytics Workspace page:
- Subscription = Your Subscription for which the LAW will reside
- Resource Group = Existing RG or create new
- Name = Specify your LAW name
- Region = Your nearest region of choice
Note: Windows Update for Business Reports Log Analytic Workspaces are only supported within certain regions, see here for full list.
I will use the following for demonstration purposes:
Add tags as needed and then review and create the LAW.
Note: Although not required, it is highly recommended to implement tagging on Azure resources for easily identification and billing purposes, see here to define your tagging strategy.
Configure the Integration
Now that we have a LAW, we need to add the Windows Update for Business Reports solution to it, to do this, within the Azure Portal, search for Monitor within the marketplace, once found, go to Workbooks and Find Windows Update for Business Reports:
Within Windows Update for Business Reports section, click Get Started at the bottom, then point the service to your desired LAW, save settings and then save again, like so:
Note: See the above screenshot, it can take up to 24 hours from Microsoft to update the LAW for Windows Update for Business reports, however, I have seen this take approx 48 hours in some cases!
Configure Windows Update for Business Reports via M365 Admin Center (OPTIONAL)
This is another option to configure the Windows Update for Business Report integration via the Microsoft 365 admin center, you will still need to have configured a LAW in advance of this, if you wish to configure via the M365 admin center, then we need to go to the M365 admin center, go to Health > Software Updates and select the Windows tab:
You guessed it, select Configure Settings, and a new window will appear, it’s as simple as selecting your Azure Subscription and then the LAW that you created previously:
Enrol Devices into the service using Microsoft Intune
Now that we have configured the integration, we need to enrol devices into the service, this can be done manually, script or via Microsoft Intune, we’ll choose the latter!
First, create a settings catalog profile for Windows 10 and later:
Give it a name and description:
Add the following to the profile and deploy to your endpoints:
Note: Once everything is in place, it can take up to 24-48 hours for data to appear in the portal.
Playing with the data
Once you have some data in the LAW, you can access it via Monitor, Workbooks and then selecting Windows Update for Business Reports:
Dashboard
Overview
You’ll see the dashboard which will give you an overview of enrolled devices, Security Update and Feature Update status’:
Quality Updates
Let’s have a look at the Quality Update dashboard:
Feature Updates
Feature updates, which will also produce an alert for any devices nearing the end of life for the OS:
Driver Updates
Delivery Optimisation
If you’re not familiar, Delivery Optimisation is peer-to-peer caching of content to reduce network bandwidth, the Windows Update for Business Reports has a section to detail how much this service has been utilised, like so:
Kusto Queries
Other than looking at the dashboard, we can query the Log Analytics Workspace directly via KUSTO queries, this is particularly useful then the inbuilt dashboards do not give you the information that you desire. Here are a few examples:
All Devices with missing security updates
UCClientUpdateStatus
| where UpdateClassification == "Security" and ClientSubstate != "UpdateInstalled"
| project DeviceName, TargetKBNumber, UpdateDisplayName, ClientSubstateTime, TimeGenerated
| order by ClientSubstateTime desc
List all devices with and without a particular KB Update
let kbNumber = "KB5037771";
let installedDevices = UCClientUpdateStatus
| where TargetKBNumber contains kbNumber and ClientState == "Installed"
| summarize Installed = count() by DeviceName;
let notInstalledDevices = UCClientUpdateStatus
| where TargetKBNumber contains kbNumber and ClientState != "Installed"
| summarize NotInstalled = count() by DeviceName;
installedDevices
| join kind=fullouter (notInstalledDevices) on DeviceName
| project DeviceName, Installed = iff(isnull(Installed), 0, 1), NotInstalled = iff(isnull(NotInstalled), 0, 1)
List all devices that either have quality and \ or feature updates paused
UCClient
| where WUQualityPauseState != "NotConfigured" or WUFeaturePauseState != "NotConfigured"
| project DeviceName, WUQualityPauseState, WUFeaturePauseState, TimeGenerated
List all devices with an outdated OS Build
UCClient
| where OSQualityUpdateStatus != "Latest"
| project DeviceName, OSVersion, OSBuild, OSQualityUpdateStatus, TimeGenerated
| order by TimeGenerated desc
Resources
https://learn.microsoft.com/en-us/windows/deployment/update/wufb-reports-overview
https://learn.microsoft.com/en-us/windows/deployment/update/wufb-reports-prerequisites
https://learn.microsoft.com/en-us/windows/deployment/update/wufb-reports-configuration-intune
Until next time!